🐛 Bug Report: SMTP Password is leaked in clear text to admins #159

New Issue

OVERLORD · 2025-10-09T16:29:59+03:00

OVERLORD commented

2025-10-09 16:29:59 +03:00

Originally created by @jeboehm on GitHub.

Reproduction steps

Set UI_CONFIG_DISABLED=true in env
Set smtp credentials, especially SMTP_PASSWORD in env
Go to application configuration, expand email
Change the password fields type from password to text or just check its value

Expected behavior

It is imperative that passwords remain undisclosed to all users, regardless of their administrative privileges.

Actual Behavior

The password set via SMTP_PASSWORD is leaked to the admin user.

Version and Environment

v1.4.1

Log Output

No response

Originally created by @jeboehm on GitHub. ### Reproduction steps - Set `UI_CONFIG_DISABLED=true` in env - Set smtp credentials, especially `SMTP_PASSWORD` in env - Go to application configuration, expand email - Change the password fields type from `password` to `text` or just check its value ### Expected behavior It is imperative that passwords remain undisclosed to all users, regardless of their administrative privileges. ### Actual Behavior The password set via `SMTP_PASSWORD` is leaked to the admin user. ### Version and Environment v1.4.1 ### Log Output _No response_

OVERLORD added the bug label 2025-10-09 16:29:59 +03:00

OVERLORD closed this issue

2025-10-09 16:30:00 +03:00

OVERLORD commented

2025-10-09 16:30:02 +03:00

@stonith404 commented on GitHub:

Thanks, this should be fixed in ba61cdba4e and will be available in the next release.

@stonith404 commented on GitHub: Thanks, this should be fixed in ba61cdba4eb3d5659f3ae6b6c21249985c0aa630 and will be available in the next release.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/pocket-id-pocket-id-2#159